Draft Ambient Scribe Basic PWS v1.0.docx

Ambient Scribe

VA-26-00012979

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Veterans Health Administration Digital Health Office

Ambient Scribe

Date: October 21, 2025

VA-26-00012979

PWS Version Number: DRAFT

Contents

BACKGROUND

The mission of the Department of Veterans Affairs (VA) Veterans Health Administration (VHA) is to provide superior healthcare services to Veterans of the United States. As the largest integrated healthcare system in the country, VA is uniquely positioned to develop and provide advanced healthcare capabilities to over 9 million Veterans. One significant challenge facing the VA and its ability to deliver high quality and reliable patient care to our Nation’s Veterans is the increase in demand for veteran patients to be seen within the VA healthcare system. In the short window of time allocated for each patient appointment, providers have a multitude of clinical and administrative tasks to be completed. This increases risk of important information being omitted due to rushed interviews and contributes to provider burn out. The myriad of tasks expected of providers beyond caring for patients puts significant cognitive burden and increased strain on them professionally. This strain has the potential to negatively impact patient care. It can also contribute to provider attrition, causing additional impact to Veterans and clinical staff.

One method to reduce the risk of missing vital clinical information that impacts patient care planning and reducing cognitive burden for our providers is the use of ambient scribe technology Artificial Intelligence (AI) ambient scribes utilize a microphone on a secure device. The ambient AI scribe transcribes patient encounters. We then use machine learning and natural-language processing to summarize the conversation's clinical content and produce a transcribed note documenting the visit. Such transcribed conversations between patients and providers automatically leverage AI technologies to create notes in the appropriate format (generate clinical documentation) and summarize a patient’s visit. Automating these tasks increases accuracy of information, saves the providers time, and reduces their mental strain. Visit notes that include a patient’s care plan is a critical component of treatment and care delivery. The software functions as a medical and clinical system, equipment, device, or software (MCSEDS) as defined in VA Directive 6008.

Ambient scribe technology also enables other labor-saving capabilities to include but not limited to: pre and post visit charting to summarize important information prior to visit by either completing the task with AI or integrating with provider pre-charted note, coding support, order capture, after-visit summaries, drafting care plans and other capabilities.

The ambient scribing solution required is unique to the operational environment and specific challenges faced by the Veterans Health Administration (VHA). In January 2024, VHA undertook an AI Technical Sprint challenge to ensure that potential solutions were rigorously tested through a competitive and impartial evaluation process under H.R. 4521-Bioeconomy Research and Development Act Of 2021 [America COMPETES Act of 2022]. The goal of the competition was to identify the top AI solutions identified through the VHA AI Tech Sprint Track 1: Ambient Dictation of Clinical Encounters.

The advanced AI-enabled tools for ambient scribing focus on enhancing clinical documentation across primary care, mental health, and specialty care settings. The solution shall meet the following requirements:

· Transcription and Note Generation: Automatically extract transcripts and key details from ambient recordings of patient encounters, creating traceable, high-fidelity medical records to include capabilities to populate diversified note templates.

· Interoperability and Integration: Seamlessly integrate with existing VA health system information technologies, particularly the Electronic Health Record (EHR) systems, to ensure smooth operational continuity and data consistency.

· Security Compliance: Adhere to stringent VA privacy and security standards for the protection of patient data.

· Advanced Functionalities: Provide continuous improvements to include record query, recommend diagnoses and referrals, inpatient discharge summaries, nursing patient management, pre-charting capabilities and maintain high performance even in challenging clinical settings.

· Patient Communications: Generate patient-facing summaries (After Visit Summaries and Discharge Summaries) that include educational materials, reminders, and follow-up recommendations which adhere to clinical documentation compliance standards.

Throughout the Technical Sprint, many solutions demonstrated superior technical maturity and clinical performance. Their development was closely aligned with the urgent needs of the VHA, specifically targeting enhancements in provider burnout and clinical documentation efficiencies. IT professionals and healthcare providers assessed these solutions for their maturity and practical applicability in real-world clinical settings, ensuring that they met the highest standards for operational readiness.

Moreover, the effectiveness and safety of these solutions were evaluated through a series of blind scoring assessments. Physicians compared the AI-generated outputs against those produced by human clinicians, establishing their accuracy and reliability without bias. Additionally, their usability and potential for seamless integration into the VHA’s existing EHR systems were critically assessed to determine their capability to enhance operational continuity and data consistency within the VA health care system. This approach ensured a thorough evaluation of potential Contractors in a manner that fostered broad competition and verified that the selected Contractors met legal, technical, and operational requirements. Evaluations concluded in May 2024.

VA personnel assigned to the Digital Health Office will coordinate with SimLEARN personnel to access the system and run a real-time test to verify outputs. The test will occur at VA’s SimLEARN facility and will be conducted by VA staff. The test will require access to the system to simulate an encounter.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

3. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022

6. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and Information Technology Act of 2006, as amended, Title IX, Information Security Matters

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

10. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

11. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

12. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

13. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended

14. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

15. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”, as amended

16. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

17. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

24. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

27. OIT Process Asset Library (PAL), OIT Process Asset Library.

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

30. VA Directive 6510, “VA Identity, Credential and Access Management,” September 3, 2024

31. VA Handbook 6510, “VA Identity, Credential and Access Management,” September 27, 2024

32. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21, 2018

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

44. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

47. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

49. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

50. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

51. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

52. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L. 110–140), December 19, 2007

53. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

55. VA Directive 0057, “VA Environmental Management Program,” October 25, 2022

56. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

57. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

58. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

59. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

60. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

61. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

62. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

63. Social Security Number (SSN) Fraud Prevention Act of 2017

64. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

65. C.F.R Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, as amended

66. Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

67. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

68. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

69. OMB M-22-18, “Enhancing the Security of the Software Supply Chain through Secure Software Development Practices,” September 14, 2022

70. OMB M-23-16, “Update to Memorandum M-22-18,” June 9, 2023

71. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27, 2021

72. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December 2014

73. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02: Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA

74. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

75. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

76. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

77. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

SCOPE OF WORK

The purpose of this Indefinite Delivery Indefinite Quantity (IDIQ) contract is to provide a Commercial-Off-the-Shelf (COTS), cloud-based, ambient scribe solution to transcribe clinical encounters, generate notes, and other AI advanced functionalities to improve the efficiency of medical care utilizing a Software as a Service (SaaS) delivery model with AI techniques and technologies. This tool shall integrate with VA’s EHR systems and workflows so providers can initiate encounter recordings. This mitigates the need for manual entry of patient identifying information and enables automatic insertion of draft notes into EHR.

PERFORMANCE DETAILS

CONTRACT TYPE

This is an IDIQ Multiple Award Task Order (MATO) contract. Individual Task Orders (TO) shall be issued on a Firm-Fixed-Price basis.

LICENSE PRICE ESCALATION RATES

License Price Escalations and reductions will be considered upon option year renewal.

ORDERING PERIOD

The ordering period for the basic contract shall be for 60-months following the date of award.

HOURS OF WORK

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Products and services ordered under this contract shall be delivered to and installed at VA locations throughout all 50 states as well as Puerto Rico and Washington D.C. as specified in individual task orders. Incidental services, such as training or on-site maintenance, shall be provided at these locations as requested by VA. Work may be performed at Contractor facilities or remote locations other than Contractor facilities with prior concurrence from the Contracting Officer Representative (COR).

TRAVEL

Travel shall be in accordance with individual TO requirements. The Government anticipates travel under this effort to perform the tasks required in the PWS and individual task orders. All travel costs shall be included in the firm-fixed price line items. Travel costs will not be directly reimbursed by the Government as a separately priced item.

There is anticipated travel in support of activating a new clinical site to include related meetings. Locations may include any VA Medical Center in the United States and Territories. Travel shall not exceed two (2) days in duration each and must be $50,000 or less.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall provide and/or acquire the services and products required by individual TOs pursuant to the requirements specified below. The Contractor shall provide Ambient Scribe and all associated licenses, applications and services necessary to meet the requirements defined in this PWS.

AMBIENT SCRIBE

FUNCTIONAL REQUIREMENTS

Individual Task Orders may encompass more than one functional requirement listed below.

PLATFORM FUNCTIONAL REQUIREMENTS

The ambient dictation system shall run passively on Government equipment or personal equipment managed under VA’s Bring Your Own Device program during clinical encounters and generate draft clinical documentation following the encounter in near real-time with a lmaximum limit of two minutes. The system should work in a variety of clinical settings, including those with poor wireless signals, poor cellular data, and in a variety of room sizes and setups. Providers shall have the opportunity to edit any AI generated material prior to signing it in the EHR. The tool shall be integrated with the EHR and workflows such that providers can conduct pre-charting, initiate encounter recording without manual entry of patient identifying information, and draft notes can be automatically inserted into the EHR without copy and paste manual effort. The base period of performance will include system integration and implementation of all AI Scribe Capabilities identified in the base license.

Finally, the Contractor shall support VA efforts to measure the impact of the solution and collaborate with VA to identify which additional integrations are needed for scalable use beyond initial capabilities.

FedRAMP The Contractor shall provide a cloud-hosted, Commercial Off-the-Shelf (COTS) ambient dictation SaaS solution, on a Contractor-provided infrastructure that is complaint with the Federal Risk Authorization Management Program (FedRAMP). See Section 8.3.4 of this PWS for additional details regarding FedRAMP and VA Authority to Operate (ATO) requirements. An accelerated Authority to Operate process for AI solutions may be utilized if the vendor’s solution meets the technical criteria. For specific platform functional requirements, the Contractor shall visit the FedRAMP website at www.fedramp.gov. For questions about FedRAMP, the Contractor shall email info@fedramp.gov.

AUTHORITY TO OPERATE

The Contractor shall obtain an agency issued ATO from the VA. A Joint Authorization Board (JAB) ATO is not acceptable as a substitute. An approved ATO shall be required for the remainder of the PoP.

SaaS SOLUTION The SaaS solution shall include a web-based app, a mobile app, or both which shall be a clinician facing component compatible with MS Windows, Apple iOS and preferably Android OS.

AMBIENT DICTATION IMPLEMENTATION

The Contractor shall implement the ambient dictation capability at identified VAMCs. The ambient dictation capability shall be configured and ready for integration within 30 calendar days of contract award. It is expected that EHR system integration will occur during the time the contractor is awaiting an ATO. The Contractor shall provide a secure URL to enable access, set up, and configuring of the platform at each site. The platform shall be capable of being supported by the VA IT help desk.The Contractor shall provide operational training, support and advice to medical center personnel on the use of the software. The solutions shall maintain and make available any transcripts or recordings for 30 days to maintain compliance with federal record schedules for intermediary documents. All intermediary documents will be deleted immediately upon day 31. Individual records may be flagged for retention longer than 30 days should a legal requirement exist such as a FOIA. Request for retention shall be made by the COR and be available until COR requests deletion.

License fees reflect the cost to use all capabilities of the vendor’s commercial product, without additional license costs to activate advanced functionality. The offeror shall make it clear exactly what capabilities are included under the license. The offeror should provide a roadmap of planned capabilities for the next year and note if those capabilities are included in the existing licenses or would be an increased cost.

If the solution has not been used by the VA previously, task orders for additional sites will not be authorized until a single site implementation has been completed to include an evaluation of product performance in an enterprise environment.

Deliverables:

A. SaaS Licenses B. Completion of the Authority to Operate Process C. Ambient Dictation Solution Available for Licensed Providers D. Required integration into the EHR’s

AMBIENT DICTATION PLATFORM TRAINING AND SUPPORT

The Contractor shall:

1. Provide remote (virtual) training for VA clinicians who have been provided licenses. Training dates shall be coordinated with VA PM and individual site points of contact (POCs). Any person or localized training shall be recorded for future reference. All training recordings captured during VA training sessions shall be provided to COR or their designee and considered VA property. The Training shall include an overview of the platform and detailed walkthrough of the capabilities. If a proprietary online training system is used for self-learning, this will not apply. It is the contractor’s responsibility to ensure proprietary self-learning systems meet the requirements to be accessed from government furnished systems.

2. Provide training materials to VA five (5) days prior to any training session. The Training Materials shall provide role-based training information and a user guide to address how to utilize the ambient dictation platform. Material shall include but not be limited to a detailed user manual and quick reference guide provided in digital formats.

3. Provide technical support (online and via phone) during normal duty hours: Monday thru Friday, 0700-1730 local time in accordance with the implementing facility’s respective time zone. Technical support shall troubleshoot and resolve technical, functional, and access issues. The Contractor shall propose call center KPIs and benchmarks in proposal but shall include at a minimum Average Speed to Answer of less than 1 minute, Abandonment Rate less than 5%, First Call Resolution Rate, and Customer Satisfaction or Net Promoter Score.

Deliverables:

A. Remote (virtual) training session for all licensed VA clinicians.

B. Training Materials.

C. Technical support (online and via phone).

ASSESSMENT, AUTHORIZATION, AND CONTINUOUS MONITORING

If the Contractor is using an externally hosted cloud solution, the Contractor shall ensure the ambient dictation SaaS solution has completed the FedRAMP ATO process as detailed below and received approval for the determined FedRAMP impact level prior to activating any software licenses for use. Contractors who are in the FedRAMP process shall be considered on a case by case basis. This shall include but is not limited to:

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA).

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. Following guidance from the Federal CIO, VA will utilize existing JAB ATO or agency ATO issued by another agency as a starting point for FedRAMP requirements. If neither of those exist, VA will sponsor FedRAMP ATO. VA will be using the FedRAMP baselines as a starting point, since they are specifically tailored for cloud services.

4. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application.

5. The Contractor shall complete a FedRAMP System Security Plan (SSP) and supporting documentation within 30 days after contract award.

6. The Contractor shall complete a Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 75 days after contract award.

7. The Contractor shall complete a 3PAO Security Assessment Report (SAR) within 90 days after contract award.

8. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases as required by FedRAMP.

9. If new or unanticipated threats or hazards are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with the security addendum B.

10. The vendor must provide a system recovery plan to address any failure of the system, to include regional backup services in the event of a local interruption

11. The Contractor shall not release any data without the consent of VA in writing. All requests for release must be submitted in writing to the COR and CO.

12. In order for live VA data to be used in this system, a FedRAMP Authorization and Agency ATO will be required. For applications hosted on the VA Enterprise Cloud an Agency ATO will still be required.

13. Any software solution must be VA Technical Reference Model (TRM) compliant. More information can be found here: VA Technical Reference Model

Deliverables:

A. FedRAMP System Security Plan (SSP) and supporting documentation (If Applicable).

B. 3PAO Security Assessment Plan (SAP) C. 3PAO Security Assessment Report (SAR) D. VA ATO completion and supporting documentation.

TRUSTWORTHY ARTIFICIAL INTELLIGENCE

For purposes of this clause, AI is defined as set forth by the VA and Section 238(g) of the National Defense Authorization Act for Fiscal Year 2019 to include:

1. Any artificial system that performs tasks under varying and unpredictable circumstances without significant human oversight, or that can learn from experience and improve performance when exposed to data sets.

1. An artificial system developed in computer software, physical hardware, or other context that solves tasks requiring human-like perception, cognition, planning, learning, communication, or physical action.

1. An artificial system designed to think or act like a human, including cognitive architectures and neural networks.

1. A set of techniques, including machine learning (ML), that is designed to approximate a cognitive task.

1. An artificial system designed to act rationally, including an intelligent software agent or embodied robot that achieves goals using perception, planning, reasoning, learning, communicating, decision making, and acting.

The Contractor shall provide a list of recommended AI for potential inclusion in the contract. The list of recommended AI shall be provided directly to the COR at least annually but also at the following times: upon proposal submission, contract award, and the COR’s request. AI shall not be used in performance of the contract without the written approval and authorization of the CO. The Contractor shall also report all AI intended for use in contract performance to VA’s National Artificial Intelligence Institute (NAII). The Contractor shall actively engage in AI discovery, assessment, and compliance activities undertaken by VA. The contractor shall report all appropriate use cases to VA CAIO through any required inventory processes.

Once the Contractor has obtained CO authorization to use specific AI in contract performance, the Contractor shall provide the COR a signed Statement of Attestation prior to AI implementation. All AI incorporated into the contract shall adhere to the VA Trustworthy AI Framework, available at https://department.va.gov/ai/trustworthy/. The Statement of Attestation shall include but is not limited to a description of all controls, processes, technologies, and mechanisms utilized to satisfy VA’s six (6) AI Principles; Purposeful, Effective and Safe, Secure and Private, Fair and Equitable, Transparent and Explainable, and Accountable and Monitored. The Statement of Attestation shall also certify that the Contractor owns or possesses all legally required rights, copyright, and licenses to use the specified AI. The Statement of Attestation shall clearly state that the use of the AI by VA personnel in performance of the contract:

1. Does not and will not infringe upon any intellectual property rights of any kind.

2. Does not violate any intellectual property rights of any kind.

3. Does not violate any other third-party rights of any kind.

The Statement of Attestation shall also affirm that there have not been any persisting or existing material errors, defects, failures, or interruptions in AI performance of its intended purpose. Additionally, the Statement of Attestation shall include the Contractor’s endorsement that the AI has materially performed in accordance with its specifications and intended purpose. Lastly, the Statement of Attestation shall be updated and resubmitted annually, prior to the exercise of contract option periods. The Statement of Attestation shall be deemed separate from, and in addition to, the Contractor’s reporting requirements relative to the use of AI. The Statement of Attestation is a material term of the contract; accordingly, failure to provide the Statement of Attestation to include all requirements, may be deemed a breach of contract and thus, cause for termination.

The Contractor (or Subcontractor at any tier, including affiliates) shall not sell, monetize, or otherwise release or misuse any VA models, training data, testing data, patterns, documentation, implementation artifacts, runtime artifacts, or any other digital artifacts, partially or as a whole, derived from AI or ML without the express written consent and approval from the CO.

The Contractor shall indemnify VA and its officers, employees, and agents against liability, including costs, for actual or alleged direct or contributory infringement of, or inducement to infringe, any United States or foreign patent, trademark, or copyright, arising out of VA use of any AI products and/or services under the contract.

The Contractor shall maintain commercially reasonable insurance coverage for claims or losses pertaining to the AI products or services being used in performance of the contract.

The Contractor shall maintain commercially reasonable and industry standard conforming security safeguards and controls, including proper access controls for the AI. The Contractor agrees the VA Contracting Officer has the unilateral right to require deactivation of any AI for any reason without notice.

Any development and/or creation of AI as a result of the performance of this contract is subject to applicable Intellectual Property and data rights clauses under the Federal Acquisition Regulation. The Contractor retains ownership of all AI technologies and methodologies developed without the use of VA resources and data assets.

This clause applies to both existing and new uses of AI, both stand-alone AI and AI embedded within other systems or applications, AI developed both by the agency or by third parties on behalf of agencies for the fulfilment of specific agency missions, including relevant data inputs used to train AI and outputs used in support of decision making, and VA procurement of AI applications.

This clause does not apply to AI embedded within common commercial products, such as word processors or map navigation systems. The Contractor shall inform the VA Contracting Officer in writing if it believes the AI it intends to use during contract performance is not covered by this clause. The burden to demonstrate the AI is a common commercial product shall rest solely with the Contractor.

Non-compliance with the terms above, or loss of sensitive VA medical records information resulting from AI use (whether accidental or intentional), may result in Contractor liability to VA for any and all rights and remedies provided by law, including but not limited to contract termination, liquidated damages, and referral to VA’s Suspension and Debarment Committee.

The Contractor shall include the substance of this clause in all subcontracts, including subcontractors at any tier and affiliates.

PROJECT MANAGEMENT

Tasks performed will be of a non-personal nature. VA organizations will not provide supervision of Contractor personnel. Contractor personnel shall at no time allow an employer-employee relationship to develop with VA organizations or their staff. VA organizations will refrain from any activities that create the appearance of such a relationship.

Contractor shall not perform inherently Governmental functions including: decision-making, supervision of Government employees, supervision of other Contractors on other contracts, and activities that create the appearance of performing such functions.

Contractor shall deliver all written artifacts using straightforward language. Technical and mathematical terms shall only be used when accompanied by a glossary. Deliverables shall be accepted based, in part, on satisfaction of Section 508 of the Rehabilitation Act of 1973. VA reserves the right to test for Section 508 Compliance before delivery. The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

Contractor shall submit final written deliverables in Microsoft Word, PowerPoint, or Excel format. Contractor shall provide files converted to Adobe PDF format upon request by the COR or Program Manager (PM).

The Contractor shall perform the tasks and complete the associated deliverables under this contract by the scheduled due dates within the overall period of performance. If the Contractor cannot deliver those deliverables specified by this contract by the required due date, then the Contractor shall provide a written explanation to the Contracting Officer (CO) within one (1) business day of the deliverable due date. This written notification shall include:

1. Justification for the delay.

2. Identification of when the Contractor knew or should have known a delay would incur.

3. Actions taken to mitigate the delay and impact on the overall project.

4. A firm commitment of when the work is to be completed.

The Government will have ten (10) business days to review each deliverable and provide feedback/comments. The Contractor shall have five (5) business days to incorporate feedback/comments and make appropriate revisions. The Contractor shall provide the revised version of each deliverable to the Contracting Officer Representative (COR). The COR will review and determine final acceptance by the Government. The COR will then notify the Contractor of final acceptance within five (5) business days.

REPORTING REQUIREMENTS

PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Project Management Plan (PMP) that describes the product delivery schedule, milestones, and risks within the deadlines established by the Government in the tasks below. The Contractor shall deliver the initial PMP at the technical kickoff meeting. Work shall not commence until the VA PM approves the final PMP.

MONTHLY PROGRESS REPORTS

The Contractor shall provide the COR with Monthly Progress Reports that include product delivery status, milestones achieved during the past month, activities planning in the coming month, and delivery risks to include recommended risk mitigations. The report shall identify problems and corrective actions. If problems have not been completely resolved, the Contractor shall provide an explanation, a description of planned course of action, and timeframe for resolving the issue. The Contractor shall monitor performance to ensure it complies with the previous report’s list of action items and report any deviations.

POST AWARD KICKOFF

The Contractor shall hold a post-award kickoff meeting within 10 business days after contract award. The Contractor shall present the details of the intended approach, work plan, and project schedule for each effort for review and approval by the Government. The Contractor shall collaborate with the Government to coordinate post-award meeting dates, agenda topics, and meeting. The meeting shall be held virtually and the Contractor shall ensure the CO, Contract Specialist (CS), COR, and VA PM receive meeting invites.

Deliverables:

A. Meeting Agenda B. Meeting Minutes

MONTHLY REPORTS

The Contractors shall deliver monthly usage reports regardless of on-demand reporting capabilities. Usage reports shall include:

1. Monthly licenses usage reports

2. Reports of license holders who have not utilized the services within the prior 30 calendar days.

3. All comments regarding quality submitted to the Contractor.

4. License burn rate estimating usage through the reminder of the contract.

5. Number of technical incidents, support requests, or security incidents.

6. The total number of scribed patient encounters.

7. Product Issue logs.

8. Feature enhancement list to licenses as applicable

ADDITIONAL INTEGRATIONS

At the end of each performance period or when requested by the COR, the Contractor shall present a list of additional capabilities available to scale the project beyond the initial AI capabilities available at time of contract. This may include but is not limited to additional data sets to connect to, software, and tools to be created as well as any additional integration that would be required.

Project Management Deliverables:

A. Project Management Plan B. Technical Integration Plan C. Monthly Progress Reports D. Post Award Kickoff Meeting Minutes E. Monthly Reports F. Report on additional capabilities available and any integrations for scalable use beyond initial capabilities.

G. Service escalation procedure H. License management procedure

OPTIONAL TASKS

OPTIONAL TASK ONE – ADDITIONAL SITE CONFIGURATIONS

VA reserves the right to execute optional tasks at any point during the contract period of performance. Execution of optional tasks will occur at the National level. The task should include support, training, configuration, and coordination to achieve successful site deployment.

OPTIONAL TASK TWO – ADDITIONAL USER LICENSES

Individual VAMCs may fund additional licenses to be billed by monthly usage on a monthly or quarterly basis. License cost increases shall not exceed 6% year-over-year throughout the performance of the contract.

OPTIONAL TASK THREE – ADDITIONAL SPECIALTY SERVICE TEMPLATES

Expansion of ambient scribe solutions into specialty care services will be initiated under this contract through DHO COR. VA will provide supplementary note templates and access to subject matter experts to ensure the ability to capture essential information for patient encounters.

OPTIONAL TASK FOUR – INTEGRATION OF ADDITIONAL AI ENABLED CAPABILITIES

The Government is interested in aligning ambient scribing capability with additional integrated capabilities to maximize the value of this technology. Specific capabilities the Government would like to see integrated with this technology include:

1. Record Query

2. Inpatient Discharge

3. Nursing workflow

4. Clinical Suggestions based on patient history

OPTIONAL TASK FIVE – ADDITIONAL LICENSES REQUIRED FOR NEW CAPABILITIES

If applicable, additional licensing for capabilities not integrated in the initial period of performance shall be made available under this task upon a price agreement between VA and the Contractor.

OPTIONAL TASK SIX – CONFIGURATION FOR VHA INTEGRATION WITH ORACLE HEALTH EHR

The platform shall be compatible with the Oracle Health EHR and (within 45 days of exercising the optional task) the Contractor shall facilitate configuration to activate the platform for VA sites that have adopted the Oracle Health EHR. (Compatible with Millennium)

GENERAL REQUIREMENTS

ENTERPRISE AND IT FRAMEWORK

VA TECHNICAL REFERENCE MODEL

The Contractor shall comply with the VA OIT Technical Reference Model (VA TRM). Compliance with the VA TRM is achieved by using only technologies and standards that are listed as approved for use in the VA TRM. The Contractor shall provide all necessary information requested by VA to ensure TRM approval is obtained prior to use on VA’s network.

ZERO TRUST – VA CRITICAL SECURITY CONTROLS

VA has established minimum mandatory security requirements and requires that any network connected software system or service must meet the VA Critical Security Controls as outlined in the VA Memorandum, “VA Security Controls”, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010. VA Critical Security Controls identify the minimum mandatory requirements that must be implemented across all VA enterprise infrastructure, cloud computing environments, information systems, networks, and specialized devices (medical devices/systems, special-purpose systems, and research scientific computing devices) that process, store, and/or transmit VA data. Effective July 1, 2025, the Contractor shall implement these VA Critical Security Controls, within any network connected software system or service prior to being authorized for use in the VA. This functional requirement is not negotiable, and Plan of Action & Milestones (POAM) will not be accepted in the event these controls cannot be implemented for new systems. Critical Security Controls are intended to increase VA’s security posture and provide security and privacy risk visibility into the VA network and is not a new requirement. The Contractor’s failure to maintain these VA Critical Controls after implementation will result in VA discontinuing the use of the system.

FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Architecture (EA), and VA Identity and Access Management (IAM) approved Enterprise Technology Guidelines (ETG). The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in Executive Order 14028, VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, CISA Binding Operational Directive 23-01, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500, and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the ETGs. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-05-24, M-19-17, M-22-09, and NIST Federal Information Processing Standard (FIPS) 201-3. Contractor delivered applications and systems shall be on the FIPS 201 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Person Index (MPI) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable Technology Guideline as outlined in VA ETG.

8. A Security Assertion Markup Language (SAML) implementation if the…